# Small & Medium Businesses

Protect your team, customers and revenue

A small or medium business is big enough to be a worthwhile target for attackers — holding customer data, processing payments, running payroll — but usually without a dedicated security team to defend it. That combination makes SMBs one of the most commonly breached categories of organization, and recovery costs (lost customers, legal exposure, downtime) can be existential for a smaller company. This section focuses on the essentials that protect your team, your customers, and your revenue without requiring enterprise budgets or headcount: access control, patching, backups, phishing awareness, and having a basic incident response plan before you need one.

## Start here

- [Getting Started: Security Essentials for Small and Medium Businesses](https://secaiq.com/getting-started-security-essentials-for-small-and-medium-businesses)

## Learning path

Work through these stages in order.

1. **Secure the basics**
   - [Cyber Essentials in Practice: A Five-Control Implementation Checklist](https://secaiq.com/cyber-essentials-in-practice-a-five-control-implementation-checklist): A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.
   - [Protect Your Accounts with Two-Factor Authentication](https://secaiq.com/protect-your-accounts-with-two-factor-authentication): The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.
   - [Creating Strong, Memorable Passwords](https://secaiq.com/creating-strong-memorable-passwords): Why passwords get cracked, what makes a password strong, and practical ways to create passwords that are hard to break but easy to remember.
2. **Keep systems patched and managed**
   - [Keep Your Devices and Apps Updated](https://secaiq.com/keep-your-devices-and-apps-updated): Updates don't just add features, they close known security holes. A simple, low-effort routine for keeping your phone and computer current.
   - [A Patch Management Program That Scales Past Patch Tuesday](https://secaiq.com/a-patch-management-program-that-scales-past-patch-tuesday): Monthly patch cycles work fine until your environment grows past a few dozen systems. A practical framework for configuration and vulnerability management that scales with your organization.
   - [Managing a Growing Fleet of Devices and IoT](https://secaiq.com/managing-a-growing-fleet-of-devices-and-iot): From laptops to smart cameras to video conferencing hardware, the number of connected devices an organization must manage keeps growing. Here's how to keep visibility as the fleet scales.
3. **Stop phishing and fraud**
   - [Recognizing Phishing in the Age of AI-Generated Scams](https://secaiq.com/recognizing-phishing-in-the-age-of-ai-generated-scams): AI tools have made phishing messages more convincing and personalized than ever, and prompt injection adds an entirely new angle. Here's what's changed, and what still works to defend against it.
   - [Business Email Compromise: The Phishing Attack That Costs Millions](https://secaiq.com/business-email-compromise-the-phishing-attack-that-costs-millions): Business email compromise causes more reported financial losses than any other cybercrime category. Understanding how it works is the key to stopping it.
4. **Protect and back up data**
   - [A Practical Guide to Data Classification for Small Teams](https://secaiq.com/a-practical-guide-to-data-classification-for-small-teams): Data classification sounds like a large-enterprise exercise with thirty categories and a governance team. A three-tier version works fine for a team of five.
   - [Encrypting and Backing Up Sensitive Data Without the Headache](https://secaiq.com/encrypting-and-backing-up-sensitive-data-without-the-headache): A practical guide to combining encryption and backups so your sensitive files are protected both from strangers who steal your device and from the disasters that destroy it.
   - [Backup and Business Continuity Beyond the Basics](https://secaiq.com/backup-and-business-continuity-beyond-the-basics): A backup that's never been tested for restoration, or an asset nobody knew existed, can undo months of planning. Here's how to build real continuity, not just a backup schedule.
5. **Prepare for incidents**
   - [Building an Incident Response Plan for Small Teams](https://secaiq.com/building-an-incident-response-plan-for-small-teams): You don't need a security team to have a plan. A simple, written incident response plan turns a chaotic security event into a manageable one.
   - [Anatomy of a Ransomware Attack: Detection, Response, and Recovery](https://secaiq.com/anatomy-of-a-ransomware-attack-detection-response-and-recovery): A step-by-step walk-through of how a ransomware attack actually unfolds inside an organization, and the decisions that determine whether it becomes a bad day or a business-ending event.
   - [Building a Security Operations Center on a Small Budget](https://secaiq.com/building-a-security-operations-center-on-a-small-budget): You do not need a room full of monitors to get most of what a SOC actually does. Here is a scaled-down version that works.
6. **Build a security culture, govern AI**
   - [Building a People-Centred Security Culture](https://secaiq.com/building-a-people-centred-security-culture): The most effective security programs treat people as a defense, not just a risk. Here's how education, practice, and culture combine to make security actually work.
   - [The Hidden Risk of Shadow AI in the Workplace](https://secaiq.com/the-hidden-risk-of-shadow-ai-in-the-workplace): An employee pastes a contract into a free AI tool to get a quick summary. It does not feel like a security incident. It might be one.
   - [How Companies Are Building AI Governance Programs From Scratch](https://secaiq.com/how-companies-are-building-ai-governance-programs-from-scratch): A growing number of organizations have no formal answer to which AI systems they are actually using and who owns the risk. Here is what building that answer from zero tends to look like.

## Guides

- [The SecAIQ App Is Now on the App Store and Google Play](https://secaiq.com/secaiq-app-now-on-app-store-and-google-play): SecAIQ is now a free mobile app for iPhone, iPad, Android phones and Android tablets: plain-language security and AI safety guides, free tools, a glossary and news, with no account needed.
- [Critical PHP Security Issue: CVE-2026-109618 and CVE-2026-109619](https://secaiq.com/critical-php-security-issue-cve-2026-109618-and-cve-2026-109619): Organisations are being urged to act now on a critical PHP issue that could allow attackers to execute commands on web servers. All PHP versions are affected and a fix has been released.
- [SecAIQ Watch: See What the AI Tools on Your Computer Are Actually Doing](https://secaiq.com/secaiq-watch-see-what-your-ai-tools-are-doing): A free, open-source, local dashboard that shows which AI tools run on your machine, what they connect to, what they can access and how many tokens they use, without ever seeing your prompts or files.
- [Recognizing and Preventing Malware Infections](https://secaiq.com/recognizing-and-preventing-malware-infections): How malware actually gets onto your devices, the warning signs of an infection, and the everyday habits that stop most attacks before they start.
- [Building an Incident Response Plan for Small Teams](https://secaiq.com/building-an-incident-response-plan-for-small-teams): You don't need a security team to have a plan. A simple, written incident response plan turns a chaotic security event into a manageable one.
- [Protect Your Accounts with Two-Factor Authentication](https://secaiq.com/protect-your-accounts-with-two-factor-authentication): The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.
- [Keep Your Devices and Apps Updated](https://secaiq.com/keep-your-devices-and-apps-updated): Updates don't just add features, they close known security holes. A simple, low-effort routine for keeping your phone and computer current.
- [Creating Strong, Memorable Passwords](https://secaiq.com/creating-strong-memorable-passwords): Why passwords get cracked, what makes a password strong, and practical ways to create passwords that are hard to break but easy to remember.
- [Recognizing and Avoiding Online Scams](https://secaiq.com/recognizing-and-avoiding-online-scams): Fake messages, "act now" pressure, and convincing lookalike websites, learn the common tricks scammers use and how to protect yourself.
- [When AI Agents Trust the Wrong Voice: Why Security Visibility Matters](https://secaiq.com/when-ai-agents-trust-the-wrong-voice-why-security-visibility-matters): Researchers at Gen Threat Labs showed an AI agent can be tricked by email content into running commands and deleting files. A vendor-sponsored article outlines layered defences, from skill vetting to runtime controls.
- [Carbonato Botnet Uses AI Agents to Take Over Exposed Docker Servers](https://secaiq.com/carbonato-botnet-ai-agents-exposed-docker-servers): Researchers have found a worm-like botnet called Carbonato that hijacks Docker servers left open to the internet and installs an AI agent to steal credentials and run commands on the attackers' behalf.
- [Google's Gemini Autonomously Hacked Three Companies During a Security Test](https://secaiq.com/googles-gemini-autonomously-hacked-three-companies-during-a-security-test): Google says its Gemini model guessed credentials and broke into three companies' websites during a May cyber-security evaluation run by Irregular, in what is thought to be the first known case of Gemini doing so on its own.
- [Google Launches an AI Professional Certificate for the Workplace](https://secaiq.com/google-launches-ai-professional-certificate-for-the-workplace): Google's new certificate teaches practical, everyday AI skills, communication, research, data analysis, and no-code app building, aimed at closing a wide gap between what managers expect from AI and what workers have actually been trained on.
- [Securing IoT and Smart Devices at Home and at Work](https://secaiq.com/securing-iot-and-smart-devices-at-home-and-at-work): From smart doorbells to warehouse sensors, connected devices multiply faster than most security programs can track them. A practical guide to keeping the Internet of Things from becoming your weakest link.
- [A Patch Management Program That Scales Past Patch Tuesday](https://secaiq.com/a-patch-management-program-that-scales-past-patch-tuesday): Monthly patch cycles work fine until your environment grows past a few dozen systems. A practical framework for configuration and vulnerability management that scales with your organization.
- [Business Email Compromise: The Phishing Attack That Costs Millions](https://secaiq.com/business-email-compromise-the-phishing-attack-that-costs-millions): Business email compromise causes more reported financial losses than any other cybercrime category. Understanding how it works is the key to stopping it.
- [Penetration Testing 101: What to Expect and How to Prepare](https://secaiq.com/penetration-testing-101-what-to-expect-and-how-to-prepare): Considering your first penetration test? A plain-language guide to what actually happens, how to scope it properly, and how to get real value out of the report you receive.
- [Encrypting and Backing Up Sensitive Data Without the Headache](https://secaiq.com/encrypting-and-backing-up-sensitive-data-without-the-headache): A practical guide to combining encryption and backups so your sensitive files are protected both from strangers who steal your device and from the disasters that destroy it.
- [Cyber Essentials in Practice: A Five-Control Implementation Checklist](https://secaiq.com/cyber-essentials-in-practice-a-five-control-implementation-checklist): A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.
- [Anatomy of a Ransomware Attack: Detection, Response, and Recovery](https://secaiq.com/anatomy-of-a-ransomware-attack-detection-response-and-recovery): A step-by-step walk-through of how a ransomware attack actually unfolds inside an organization, and the decisions that determine whether it becomes a bad day or a business-ending event.
- [Remote Work Security Testing and Supply Chain Awareness](https://secaiq.com/remote-work-security-testing-and-supply-chain-awareness): Distributed teams and third-party tools expand an organization's attack surface in ways that are easy to overlook. Here's how testing and vendor awareness help close that gap.
- [Recognizing Phishing in the Age of AI-Generated Scams](https://secaiq.com/recognizing-phishing-in-the-age-of-ai-generated-scams): AI tools have made phishing messages more convincing and personalized than ever, and prompt injection adds an entirely new angle. Here's what's changed, and what still works to defend against it.
- [Managing a Growing Fleet of Devices and IoT](https://secaiq.com/managing-a-growing-fleet-of-devices-and-iot): From laptops to smart cameras to video conferencing hardware, the number of connected devices an organization must manage keeps growing. Here's how to keep visibility as the fleet scales.
- [Anatomy of a Cyber Attack: From Reconnaissance to Ransom](https://secaiq.com/anatomy-of-a-cyber-attack-from-reconnaissance-to-ransom): Understanding the typical stages of a cyber attack helps you recognize warning signs earlier, and understand why national cyber strategy focuses where it does.
- [Backup and Business Continuity Beyond the Basics](https://secaiq.com/backup-and-business-continuity-beyond-the-basics): A backup that's never been tested for restoration, or an asset nobody knew existed, can undo months of planning. Here's how to build real continuity, not just a backup schedule.
- [Closing the Window: Patch and Configuration Management](https://secaiq.com/closing-the-window-patch-and-configuration-management): Most breaches exploit vulnerabilities that already had a fix available. Patch and configuration management turn "we'll get to it" into a repeatable, low-drama process.
- [Building a People-Centred Security Culture](https://secaiq.com/building-a-people-centred-security-culture): The most effective security programs treat people as a defense, not just a risk. Here's how education, practice, and culture combine to make security actually work.
- [Securing Your Cloud Accounts and Data](https://secaiq.com/securing-your-cloud-accounts-and-data): From email to file storage, most of what you rely on daily now lives in the cloud. Here's how to keep those accounts, and the personal data inside them, genuinely secure.
- [IoT and Smart Device Security Basics](https://secaiq.com/iot-and-smart-device-security-basics): Smart cameras, speakers, thermostats and doorbells all connect to your network, and most ship with weak default security. Here's how to lock them down.
- [Securing Remote Work, Video Calls, and Social Media](https://secaiq.com/securing-remote-work-video-calls-and-social-media): Working from anywhere means your security perimeter now includes home Wi-Fi, video meetings, and the social profiles that reveal more about you than you might think.
- [Back Up Your Important Files Regularly](https://secaiq.com/back-up-your-important-files-regularly): Photos, documents and memories can disappear in an instant. A simple approach to backing up your phone (Android/iPhone) and computer.
- [Anthropic Adds Invisible Watermarking to Claude-Generated Content](https://secaiq.com/anthropic-adds-invisible-watermarking-to-claude-generated-content): Anthropic is embedding an invisible statistical watermark in Claude output, giving verification tools a way to flag AI-generated text and images without changing how the content looks or reads.
- [Security Teams Report New Vulnerability Patterns in AI-Generated Code](https://secaiq.com/security-teams-report-new-vulnerability-patterns-in-ai-generated-code): A survey of application security teams finds AI coding assistants reproducing a distinct, recurring set of flaws, and doing it identically across many unrelated codebases at once.
- [AI-Generated Deepfake Voice Calls Used in Executive Impersonation Scams](https://secaiq.com/ai-generated-deepfake-voice-calls-used-in-executive-impersonation-scams): Vishing attacks using AI-cloned executive voices are rising, with attackers needing only a short public recording to produce a convincing impersonation for a wire-transfer request.
- [How Companies Are Building AI Governance Programs From Scratch](https://secaiq.com/how-companies-are-building-ai-governance-programs-from-scratch): A growing number of organizations have no formal answer to which AI systems they are actually using and who owns the risk. Here is what building that answer from zero tends to look like.
- [The Hidden Risk of Shadow AI in the Workplace](https://secaiq.com/the-hidden-risk-of-shadow-ai-in-the-workplace): An employee pastes a contract into a free AI tool to get a quick summary. It does not feel like a security incident. It might be one.
- [Anatomy of a Ransomware Negotiation](https://secaiq.com/anatomy-of-a-ransomware-negotiation): Most organizations plan for how to prevent ransomware. Very few plan for what happens in the 48 hours after the note appears. Here is what that actually looks like.
- [Why Penetration Testing Isn't a One-Time Checkbox](https://secaiq.com/why-penetration-testing-isn-t-a-one-time-checkbox): An annual pen test satisfies an auditor. It rarely tells you much about your actual exposure eleven months later.
- [Building a Security Operations Center on a Small Budget](https://secaiq.com/building-a-security-operations-center-on-a-small-budget): You do not need a room full of monitors to get most of what a SOC actually does. Here is a scaled-down version that works.
- [The Principle of Least Privilege, Explained Simply](https://secaiq.com/the-principle-of-least-privilege-explained-simply): One of the oldest ideas in security. Also one of the most consistently ignored, not out of neglect, usually, but out of convenience.
- [Why Encryption Alone Doesn't Mean Your Data Is Safe](https://secaiq.com/why-encryption-alone-doesn-t-mean-your-data-is-safe): Our data is encrypted gets treated as a complete answer to is our data secure. It is a necessary layer, not a sufficient one, and the gap has caused real breaches.
- [A Practical Guide to Data Classification for Small Teams](https://secaiq.com/a-practical-guide-to-data-classification-for-small-teams): Data classification sounds like a large-enterprise exercise with thirty categories and a governance team. A three-tier version works fine for a team of five.
- [The 3-2-1 Backup Rule, and Why It Still Holds Up](https://secaiq.com/the-3-2-1-backup-rule-and-why-it-still-holds-up): The rule predates both modern ransomware and cloud storage as most people use it. It still holds up, and the reason why has not changed.